GHSA-9983-vrx2-fg9c: github.com/nats-io/nats-server/v2 fixed in 2.12.6 and 2.11.15

GHSA-9983-vrx2-fg9c PUBLISHED CVSS 4.900000095367432 MEDIUM

NATS JetStream has an authorization bypass through its Management API

Record from GitHub Advisory Database · Published March 24, 2026

github.com/nats-io/nats-server/v2 is fixed in 2.12.6 and 2.11.15 (Go Modules)

NATS JetStream has an authorization bypass through its Management API

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
github.com/nats-io/nats-server/v2	Go Modules	2.12.6, 2.11.15
rke2-runtime-fips-1.33	Chainguard	1.33.10.2.3-r2
nats-top	Chainguard	0.6.3-r18
telegraf-1.37	Wolfi	1.37.3-r6
kine	Wolfi	0.14.15-r1
rke2-runtime-1.34	Chainguard	1.34.5.2.1-r3
rke2-runtime-1.35	Chainguard	1.35.2.2.1-r3
k3s	Chainguard	1.35.2.1-r4
nats-top	Wolfi	0.6.3-r18
telegraf-1.38	Wolfi	1.38.1-r1
k3s-1.33	Wolfi	1.33.9.1-r6
k3s	Wolfi	1.35.2.1-r4

16 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

4.900000095367432

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Affected products

Vendor	Product	Versions
chainguard	rke2-runtime-fips-1.33	0
chainguard	nats-top	0
wolfi	telegraf-1.37	0
wolfi	kine	0
chainguard	rke2-runtime-1.34	0
chainguard	rke2-runtime-1.35	0
chainguard	k3s	0
wolfi	nats-top	0
wolfi	telegraf-1.38	0
wolfi	k3s-1.33	0
wolfi	k3s	0
chainguard	nats-top-fips	0
wolfi	nats	0
chainguard	k3s-1.33	0
github.com	nats-io/nats-server	0
chainguard	telegraf-1.38	0
chainguard	nats	0
chainguard	nats-fips	0
chainguard	rke2-runtime-fips-1.35	0
chainguard	prometheus-nats-exporter-fips	0

…and 10 more

Timeline

Mar 24, 2026 CVE Published
Mar 27, 2026 CVE Updated
Apr 29, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-9983-vrx2-fg9c
vulnetix vdb fixes GHSA-9983-vrx2-fg9c

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-9983-vrx2-fg9c/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →